Positron developer here 👋 if it's any solace, l just removed that notification from showing unless there is a Python console running (boring backstory, a Python may be used in background for LS purposes) positron#16924 LMK if you see this again once we do our monthly release this week!
1 like
If this happens again, run the command "Runtime Startup Diagnostics" from the Command Palette & post it on our discussion forum. Maybe we can figure out what's going on!
github.com/posit-dev/positron/discussions
1 like
Positron adds hooks that integrate R with its UI, and talks to R through a kernel interface. It could be slower, but we definitely wouldn't expect 20x! Would you be willing to share more details on our discussion forum? (code would really help) github.com/posit-dev/positron/discussions
1 like
CVE-2026-108258: CVE-2026-108258: Path Traversal in Shiny for Python Bookmark Restoration
CVE-2026-108258: Path Traversal in Shiny for Python Bookmark Restoration
> Vulnerability ID: CVE-2026-108258
> CVSS Score: 6.9
> Published: 2026-10-09
A path traversal vulnerability in Shiny for Python (posit-dev/py-shiny) versions 1.4.0 through 1.6.3 allows unauthenticated remote attackers to read arbitrary files and traverse directories via crafted _state_id_ query parameters.
TL;DR
Unsanitized query parameters in Shiny for Python's session bookmark feature allow unauthenticated path traversal and arbitrary file read.
---
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-22
- Attack Vector: Network (HTTP / WebSocket)
- CVSS v4.0 Score: 6.9 (Medium)
- Exploit Status: Proof of Concept / Public Patch
- CISA KEV Status: Not Listed
- Authentication Required: None (Unauthenticated)
Affected Systems
- Shiny for Python (PyPI package 'shiny') applications using session state bookmarking
- shiny: >= 1.4.0, < 1.6.4 (Fixed in: 1.6.4)
Code Analysis
Commit: 1d8ecb4
Fix path traversal in bookmark state restoration
Exploit Details
- GitHub Security Advisory: Technical description and reproduction details in official repository advisory
Mitigation Strategies
- Upgrade Shiny for Python package to version 1.6.4 or later.
- Configure Web Application Firewall (WAF) rules to filter directory traversal sequences in URL query parameters.
- Disable server-side bookmark storage if session persistence is not required.
Remediation Steps:
1. Execute 'pip install --upgrade shiny' in the application environment.
2. Verify the installed version using 'python -c "import shiny; print(shiny.version)"' ensures version >= 1.6.4.
3. Deploy WAF rules blocking HTTP GET parameters containing '_state_id=' with '..' or absolute paths.
References
- GitHub Security Advisory GHSA-47c3-hpmg-7j6p
- Official Patch Commit
- Shiny for Python Release v1.6.4
- NVD CVE-2026-108258 Detail
- CVE Record CVE-2026-108258
---
Read the full report for CVE-2026-108258 on our website for more details including interactive diagrams and full exploit analysis.
Depends a bit on your environment! You can use rsconnect::addServer() to add your Connect server, or Positron's environment variables setting to add CONNECT_SERVER and CONNECT_API_KEY to your console. If that doesn't do what you need, we'd love to hear more details here: github.com/posit-dev/positron/discussions
Mentions
Positron developer here 👋 if it's any solace, l just removed that notification from showing unless there is a Python console running (boring backstory, a Python may be used in background for LS purposes) positron#16924 LMK if you see this again once we do our monthly release this week!
If this happens again, run the command "Runtime Startup Diagnostics" from the Command Palette & post it on our discussion forum. Maybe we can figure out what's going on! github.com/posit-dev/positron/discussions
Positron adds hooks that integrate R with its UI, and talks to R through a kernel interface. It could be slower, but we definitely wouldn't expect 20x! Would you be willing to share more details on our discussion forum? (code would really help) github.com/posit-dev/positron/discussions
CVE-2026-108258: CVE-2026-108258: Path Traversal in Shiny for Python Bookmark Restoration CVE-2026-108258: Path Traversal in Shiny for Python Bookmark Restoration > Vulnerability ID: CVE-2026-108258 > CVSS Score: 6.9 > Published: 2026-10-09 A path traversal vulnerability in Shiny for Python (posit-dev/py-shiny) versions 1.4.0 through 1.6.3 allows unauthenticated remote attackers to read arbitrary files and traverse directories via crafted _state_id_ query parameters. TL;DR Unsanitized query parameters in Shiny for Python's session bookmark feature allow unauthenticated path traversal and arbitrary file read. --- ⚠️ Exploit Status: POC Technical Details - CWE ID: CWE-22 - Attack Vector: Network (HTTP / WebSocket) - CVSS v4.0 Score: 6.9 (Medium) - Exploit Status: Proof of Concept / Public Patch - CISA KEV Status: Not Listed - Authentication Required: None (Unauthenticated) Affected Systems - Shiny for Python (PyPI package 'shiny') applications using session state bookmarking - shiny: >= 1.4.0, < 1.6.4 (Fixed in: 1.6.4) Code Analysis Commit: 1d8ecb4 Fix path traversal in bookmark state restoration Exploit Details - GitHub Security Advisory: Technical description and reproduction details in official repository advisory Mitigation Strategies - Upgrade Shiny for Python package to version 1.6.4 or later. - Configure Web Application Firewall (WAF) rules to filter directory traversal sequences in URL query parameters. - Disable server-side bookmark storage if session persistence is not required. Remediation Steps: 1. Execute 'pip install --upgrade shiny' in the application environment. 2. Verify the installed version using 'python -c "import shiny; print(shiny.version)"' ensures version >= 1.6.4. 3. Deploy WAF rules blocking HTTP GET parameters containing '_state_id=' with '..' or absolute paths. References - GitHub Security Advisory GHSA-47c3-hpmg-7j6p - Official Patch Commit - Shiny for Python Release v1.6.4 - NVD CVE-2026-108258 Detail - CVE Record CVE-2026-108258 --- Read the full report for CVE-2026-108258 on our website for more details including interactive diagrams and full exploit analysis.
Depends a bit on your environment! You can use rsconnect::addServer() to add your Connect server, or Positron's environment variables setting to add CONNECT_SERVER and CONNECT_API_KEY to your console. If that doesn't do what you need, we'd love to hear more details here: github.com/posit-dev/positron/discussions